Related-Key Chosen IV Attacks on Grain-v1 and Grain-128

Lee, Yunho; Jeong, Kwang Seob; Sung, Jaechul; Hong, Seokhie

doi:10.1007/978-3-540-70500-0_24

Cited by 49 publications

(31 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [9] a sliding property was used to speed-up exhaustive search by a factor of two. Related-key attacks on the full cipher were presented in [10]. However, the relevance of related-key attacks is disputed, and in this paper we concentrate on attacks in the single key model.…”

Section: Previous Results On Grain-128mentioning

confidence: 99%

An Experimentally Verified Attack on Full Grain-128 Using Dedicated Reconfigurable Hardware

Dinur

Güneysu

Paar

et al. 2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. In this paper we describe the first single-key attack which can recover the full key of the full version of Grain-128 for arbitrary keys by an algorithm which is significantly faster than exhaustive search (by a factor of about 2 38 ). It is based on a new version of a cube tester, which uses an improved choice of dynamic variables to eliminate the previously made assumption that ten particular key bits are zero. In addition, the new attack is much faster than the previous weak-key attack, and has a simpler key recovery process. Since it is extremely difficult to mathematically analyze the expected behavior of such attacks, we implemented it on RIVYERA, which is a new massively parallel reconfigurable hardware, and tested its main components for dozens of random keys. These tests experimentally verified the correctness and expected complexity of the attack, by finding a very significant bias in our new cube tester for about 7.5% of the keys we tested. This is the first time that the main components of a complex analytical attack are successfully realized against a full-size cipher with a special-purpose machine. Moreover, it is also the first attack that truly exploits the configurable nature of an FPGA-based cryptanalytical hardware.

show abstract

Section: Previous Results On Grain-128mentioning

confidence: 99%

An Experimentally Verified Attack on Full Grain-128 Using Dedicated Reconfigurable Hardware

Dinur

Güneysu

Paar

et al. 2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The above idea is at the basis of "slide resynchronization" attacks on the stream cipher Grain [16,28], which are related-key attacks using as relation a rotation of the key, to simulate a persistent shift between two internal states.…”

Section: Resistance To Slide Distinguishersmentioning

confidence: 99%

Quark: A Lightweight Hash

Aumasson

Henzen

Meier

et al. 2010

Cryptographic Hardware and Embedded Systems, CHES 2010

192

View full text Add to dashboard Cite

Abstract. The need for lightweight cryptographic hash functions has been repeatedly expressed by application designers, notably for implementing RFID protocols. However not many designs are available, and the ongoing SHA-3 Competition probably won't help, as it concerns general-purpose designs and focuses on software performance. In this paper, we thus propose a novel design philosophy for lightweight hash functions, based on a single security level and on the sponge construction, to minimize memory requirements. Inspired by the lightweight ciphers Grain and KATAN, we present the hash function family Quark, composed of the three instances u-Quark, d-Quark, and t-Quark. Hardware benchmarks show that Quark compares well to previous lightweight hashes. For example, our lightest instance u-Quark conjecturally provides at least 64-bit security against all attacks (collisions, multicollisions, distinguishers, etc.), fits in 1379 gate-equivalents, and consumes in average 2.44 ñW at 100 kHz in 0.18 ñm ASIC. For 112-bit security, we propose t-Quark, which we implemented with 2296 gate-equivalents.

show abstract

“…Our experiments indicate that these are dense, high-degree polynomials involving a large number of internal state bits. Thus, the number of cycles in the initialisation process seems to be sufficient for diffusing the bits of the initial state in a very complex way, and we believe that rakaposhi is secure against the most recent attacks on the initialisation process [10,25,32,35].…”

Section: Analysis Of the Initialisation Processmentioning

confidence: 99%

The rakaposhi Stream Cipher

Cid

Kiyomoto

Kurihara

2009

Information and Communications Security

View full text Add to dashboard Cite

Abstract. In this paper, we introduce the rakaposhi stream cipher. The algorithm is based on Dynamic Linear Feedback Shift Registers, with a simple and potentially scalable design, and is particularly suitable for hardware applications with restricted resources. The rakaposhi stream cipher offers 128-bit security, and aims to complement the current eSTREAM portfolio of hardware-oriented stream ciphers.

show abstract

Related-Key Chosen IV Attacks on Grain-v1 and Grain-128

Cited by 49 publications

References 3 publications

An Experimentally Verified Attack on Full Grain-128 Using Dedicated Reconfigurable Hardware

An Experimentally Verified Attack on Full Grain-128 Using Dedicated Reconfigurable Hardware

Quark: A Lightweight Hash

The rakaposhi Stream Cipher

Contact Info

Product

Resources

About